#supply-chain-attacks
#supply-chain-attacks

1 day ago

Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows

Megalodon used forged CI workflow commits to exfiltrate CI secrets, cloud credentials, tokens, keys, and configuration data from thousands of GitHub repositories within hours.

fromnews.bitcoin.com

Information security

GitHub Worm Hits npm Packages With 16M Downloads

1 day ago

Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows

Megalodon used forged CI workflow commits to exfiltrate CI secrets, cloud credentials, tokens, keys, and configuration data from thousands of GitHub repositories within hours.

fromnews.bitcoin.com

GitHub Worm Hits npm Packages With 16M Downloads

A GitHub Actions cache poisoning attack enabled malicious npm packages to pass provenance checks, while a dead-man’s switch wipes developer machines if the npm token is revoked.

GitHub investigates attack via malicious VS Code extension

A malicious VS Code extension likely enabled unauthorized access to GitHub internal repositories, with no confirmed customer data compromise yet.

1 day ago

Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack

Unauthorized access to Grafana Labs GitHub repositories resulted from a TanStack supply chain attack, leading to token compromise, code theft, and mitigations without customer production impact.

fromThisweekinreact

This Week In React #282: Security, Fate, TanStack, Redux, Jotai, Base UI, Relay, Storybook | Hermes-node, Expo, Rozenite, Harness, VR, Nitro, Skia, Redraw | TC39, Bun, pnpm, npm, Yarn, Node, Webpack | This Week In React

More packages are being compromised, and blog posts are also covering recent RSC vulnerabilities. Maybe we're reaching a tipping point, and better security practices will consolidate this year. On the React Native side, Hermes-node is quite exciting, although it's very early. An exciting TC39 meeting is currently underway, and several proposals have already progressed. Yarn and npm are improving on the security side. Bun and pnpm are being ported to Rust.

React

2 days ago

GitHub Breach Tied to Malicious VS Code Extension Exposes Thousands of Internal Repositories

A compromised Visual Studio Code extension led to access of about 3,800 internal repositories, with no evidence found of customer or external enterprise impact.

fromTNW | Data-Security

2 days ago

GitHub breached via poisoned VS Code extension, 3,800 repos stolen

A poisoned VS Code extension enabled TeamPCP to exfiltrate about 3,800 internal GitHub repositories after compromising an employee device.

#cybersecurity

Information security

GitHub says hackers stole data from thousands of internal repositories | TechCrunch

fromArs Technica

Information security

Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack

Information security

Hacker hijacks Axios open-source project, used by millions, to push malware | TechCrunch

Information security

TeamPCP Moves From OSS to AWS Environments

Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More

The internet remains vulnerable, with supply chain attacks and new malware techniques posing significant threats to security.

Software development

10 months ago

Open-source malware surges 188 percent, targeting developers

A significant rise in malicious open-source packages was discovered, indicating a 188% increase in Q2 2025 compared to the previous year.

GitHub says hackers stole data from thousands of internal repositories | TechCrunch

Attackers compromised an employee device via a poisoned VS Code extension and stole data from about 3,800 internal GitHub repositories.

fromArs Technica

Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack

A minimalistic backdoor and a complex backdoor called QUIC RAT were identified in targeted attacks on various organizations.

Hacker hijacks Axios open-source project, used by millions, to push malware | TechCrunch

A hacker compromised the Axios library to deliver malware, risking millions of developers' systems.

TeamPCP Moves From OSS to AWS Environments

TeamPCP has exploited compromised credentials to target open source software, leading to significant data exfiltration and supply chain attacks.

Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More

The internet remains vulnerable, with supply chain attacks and new malware techniques posing significant threats to security.

10 months ago

Software development

Open-source malware surges 188 percent, targeting developers

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

A compromised NPM maintainer account published malicious package versions that triggered multi-stage credential theft and persistence across CI environments and developer tooling.

fromtheregister

Shai-Hulud copycat worm infects yet another npm package

A Shai-Hulud credential-stealing worm clone appeared in a malicious npm package, alongside three other infostealer packages from the same npm user.

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

A compromised NPM maintainer account published malicious package versions that triggered multi-stage credential theft and persistence across CI environments and developer tooling.

fromtheregister

Shai-Hulud copycat worm infects yet another npm package

A Shai-Hulud credential-stealing worm clone appeared in a malicious npm package, alongside three other infostealer packages from the same npm user.

Pip 26.1 Ships Dependency Cooldowns and Experimental Lockfile Support to Combat Supply Chain Attacks

Pip 26.1 adds dependency cooldowns and experimental pylock.toml lockfile support, patches two CVEs, and drops Python 3.9.

GitHub Confirms Hack Impacting 3,800 Internal Repositories

About 3,800 GitHub internal repositories were exfiltrated after a poisoned VS Code extension compromised an employee workstation, prompting secret rotation and ongoing monitoring.

Privacy professionals

U.S. cybersecurity agency leaks GovCloud keys on GitHub

Public GitHub exposure revealed CISA-related credentials, including AWS GovCloud administrative keys and plaintext passwords, enabling high-privilege access to internal systems and build environments.

#open-source-security

Information security

Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack | TechCrunch

5 days ago

Information security

First Shai-Hulud Worm Clones Emerge

OpenAI says hackers stole some data after latest code security issue | TechCrunch

Hackers injected malicious updates into open source TanStack, compromising OpenAI employee devices and stealing limited credentials while not accessing user data or altering production systems.

Information security

How Open Source Dependency and Repo Attacks Compromise DevOps Pipelines and How to Stay Safe - DevOps.com

Open source repositories are continuously targeted, and supply-chain attacks exploit weak dependency governance and insecure development practices to compromise many systems at once.

Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack | TechCrunch

Hackers compromised open source project accounts and released malicious updates to steal credentials and spread malware to downstream users.

5 days ago

First Shai-Hulud Worm Clones Emerge

Shai-Hulud worm source code release enabled rapid cloning and renewed supply-chain attacks targeting open source package ecosystems.

OpenAI says hackers stole some data after latest code security issue | TechCrunch

Hackers injected malicious updates into open source TanStack, compromising OpenAI employee devices and stealing limited credentials while not accessing user data or altering production systems.

more#open-source-security

How Open Source Dependency and Repo Attacks Compromise DevOps Pipelines and How to Stay Safe - DevOps.com

Open source repositories are continuously targeted, and supply-chain attacks exploit weak dependency governance and insecure development practices to compromise many systems at once.

#npm-security

fromInfoQ

Information security

TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages

Node JS

Malicious NPM Package Gets Downloaded 50K Times Before Discovery - DevOps.com

fromInfoQ

TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages

A supply-chain attack poisoned GitHub Actions caches and workflows to publish malicious npm package versions, stealing credentials and propagating malware without npm credential compromise.

Node JS

Malicious NPM Package Gets Downloaded 50K Times Before Discovery - DevOps.com

A malicious npm package downloaded 50,000 times used naming deception and preinstall script hooks to evade detection and compromise Windows, Linux, and macOS systems.

Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

A compromised Nx Console VS Code extension silently installs a credential-stealing payload via an orphan commit, exfiltrating secrets and adding a macOS backdoor.

Information security

Devs of VS Code extensions are leaking secrets en masse

Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

A compromised Nx Console VS Code extension silently installs a credential-stealing payload via an orphan commit, exfiltrating secrets and adding a macOS backdoor.

Information security

Devs of VS Code extensions are leaking secrets en masse

more#vs-code-extensions

TeamPCP Ups the Game, Releases Shai-Hulud Worm's Source Code

Released Shai-Hulud worm source code enables copycat supply-chain attacks and rapid creation of malware variants.

GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data

GemStuffer abuses RubyGems to exfiltrate scraped UK council portal content by publishing data-bearing gems using hardcoded API keys.

#malware

fromwww.theregister.com

Information security

Malware crew TeamPCP open-sources its Shai-Hulud worm on GitHub

'PCPJack' Worm Removes TeamPCP Infections, Steals Credentials

PCPJack removes TeamPCP artifacts, then deploys a self-propagating credential-stealing framework across cloud environments using modular payloads.

fromInfoWorld

Information security

Malware crew TeamPCP open-sources its Shai-Hulud worm on GitHub

Shai-Hulud worm source code was open-sourced, enabling rapid modification and credential-stealing attacks against npm packages and cloud accounts.

'PCPJack' Worm Removes TeamPCP Infections, Steals Credentials

PCPJack removes TeamPCP artifacts, then deploys a self-propagating credential-stealing framework across cloud environments using modular payloads.

fromInfoWorld

Mistral AI SDK, TanStack Router hit in npm software supply chain attack

Automated Mini Shai-Hulud worm attacks rapidly spread through package ecosystems on May 11 by hijacking release pipelines via pull_request_target and maintainer misconfigurations.

Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

TeamPCP modified npm and PyPI packages to run obfuscated environment profiling and credential stealing, exfiltrating data via external domains and GitHub token abuse.

TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa_1c16 that was published on December 17, 2025 or previously," the cybersecurity company said in a statement over the weekend.

Information security

Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged

A modified Checkmarx Jenkins AST plugin was published on the Jenkins Marketplace, and untrusted versions must be replaced with the verified release.

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack

A modified Checkmarx Jenkins AST plugin was published via the Jenkins Marketplace, prompting users to update to a safe version. Supply-chain compromise traces to prior repository access.

fromtheregister

Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged

A modified Checkmarx Jenkins AST plugin was published on the Jenkins Marketplace, and untrusted versions must be replaced with the verified release.

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack

A modified Checkmarx Jenkins AST plugin was published via the Jenkins Marketplace, prompting users to update to a safe version. Supply-chain compromise traces to prior repository access.

Worm rubs out competitor's malware, then takes control

A credential-harvesting worm removes prior TeamPCP traces, then propagates autonomously to internal and external cloud targets.

Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants

ABW reports increased 2024–2025 cyberattacks on Polish OT and water infrastructure, enabling ICS parameter changes and risking service disruption.

fromInfoQ

Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them

Supply chain attacks exploit trust in software ecosystems, allowing attackers to inject malicious code into widely used plugins and packages.

Quasar Linux malware targets DevOps environments

A new Linux malware named Quasar Linux (QLNX) targets developers, employing stealth techniques and extensive espionage capabilities to remain undetected.

Privacy technologies

Google's Android Apps Get Public Verification to Stop Supply Chain Attacks

Google expands Binary Transparency for Android to protect against supply chain attacks and ensure software integrity.

Ongoing supply chain attacks worm into SAP npm packages

Supply chain attacks have compromised multiple npm packages, including those from SAP and Intercom, with credential-stealing malware affecting developers.

Don't pay VECT a ransom - your big files are likely gone

Organizations affected by Trivy and LiteLLM compromises that paid Vect likely received little data recovery, according to Check Point Research.

Information security

Ransomware Groups Claimed 2,000 Attacks in Just Three Months

fromIT Pro

6 months ago

Information security

Ransomware attacks are hitting European enterprises at record pace

Don't pay VECT a ransom - your big files are likely gone

Organizations affected by Trivy and LiteLLM compromises that paid Vect likely received little data recovery, according to Check Point Research.

Information security

Ransomware Groups Claimed 2,000 Attacks in Just Three Months

fromIT Pro

6 months ago

Information security

Ransomware attacks are hitting European enterprises at record pace

Open source package with 1 million monthly downloads stole user credentials

Developers must uninstall version 0.23.3 of elementary-data due to security vulnerabilities and follow specific remediation steps.

Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data

SBOMs and VEX statements fail to enhance software supply chain security due to poor decision-making and inconsistent interpretation of available data.

#ai-security

Artificial intelligence

The MCP Disclosure Is the AI Era's 'Open Redirect' Moment

The Model Context Protocol has a design flaw that enables AI supply chain attacks, posing a significant security risk to enterprise AI systems.

Information security

Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Information security

Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors

Artificial intelligence

The MCP Disclosure Is the AI Era's 'Open Redirect' Moment

The Model Context Protocol has a design flaw that enables AI supply chain attacks, posing a significant security risk to enterprise AI systems.

Information security

Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Information security

Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors

Aikido Endpoint offers developers additional protection against supply chain attacks

Aikido Endpoint protects developers' endpoints from supply chain attacks by blocking high-risk installations before they reach the system.

Python

fromTalkpython

OWASP Top 10 (2025 List) for Python Devs

The OWASP Top 10 has been updated with significant changes including supply chain attacks and exceptional condition handling.

Two different attackers poisoned popular open source tools

Two major supply chain attacks in March compromised open source tools, stealing data from numerous organizations.

Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches

All analyzed companies operate AI-enabled SaaS environments, with organizations averaging 140 such applications, creating cascading breach risks across interconnected systems.

fromBleepingComputer

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

GlassWorm supply-chain campaign compromised 433 components across GitHub, npm, and VSCode/OpenVSX, using a single Solana blockchain address for command-and-control across coordinated attacks targeting cryptocurrency wallets and developer credentials.

fromArs Technica

Supply-chain attack using invisible code hits GitHub and other repositories

Hackers use invisible Unicode characters to hide malicious code that appears as whitespace to humans but executes normally in JavaScript and AI systems.

Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware

A coordinated campaign uses fake Next.js repositories and job assessment lures to trick developers into executing malicious code that establishes persistent command-and-control access.

Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

This week's recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely question. Another signal: attackers are mixing old and new methods. Legacy botnet tactics, modern cloud abuse, AI assistance, and supply-chain exposure are being used side by side, whichever path gives the easiest foothold.

Tech industry

#npm

Node JS

npm's Update to Harden Their Supply Chain, and Points to Consider

Node JS

GitHub Boosting Security in Response to NPM Supply Chain Attacks

Node JS

npm's Update to Harden Their Supply Chain, and Points to Consider

Node JS

GitHub Boosting Security in Response to NPM Supply Chain Attacks

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

North Korea-linked Lazarus Group used fake recruitment campaigns to distribute malicious npm and PyPI packages embedded via dependencies in coding-assessment repositories.

Supply chain breaches fuel cybercrime cycle, report says

Cybercriminals are industrializing supply chain attacks into a self-reinforcing ecosystem combining package compromise, credential theft, identity attacks, and ransomware.

fromwww.theguardian.com

State-sponsored hackers targeting defence sector employees, Google says

The report catalogues a relentless barrage of cyber operations, most by state-sponsored groups, against EU and US industrial supply chains. It suggests the range of targets for these hackers has grown to encompass the broader industrial base of the US and Europe from German aerospace firms to UK carmakers. State-linked hackers have long targeted the global defence industry, but Luke McNamara, an analyst for Google's threat intelligence group, said they had seen more personalised and direct to individual targeting of employees.

Information security

Miscellaneous

fromwww.theguardian.com

This is business as usual': boss of bombed Ukrainian vodka maker seeks to expand exports

Ukrainian businesses, exemplified by Nemiroff vodka, sustain and expand exports despite war-related attacks, driving sales growth in Western markets.

React

fromblog.logrocket.com

How to build agentic AI when your data can't leave the network - LogRocket Blog

AI advancements, supply chain attacks, and framework breakthroughs reshaped frontend development in 2025 alongside practical guidance for React Native styling, UI libraries, and TypeScript typing.

fromComputerWeekly.com

5 months ago

What lies in store for the security world in 2026? | Computer Weekly

Budget cuts and reduced cybersecurity staffing have degraded defenses, causing longer dwell times, slower detection, and greater exposure to supply‑chain and zero‑day attacks in 2026.

5 months ago

Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More

Fortinet has warned that a new security flaw in FortiWeb has been exploited in the wild. The medium-severity vulnerability, tracked as CVE-2025-58034, carries a CVSS score of 6.7 out of a maximum of 10.0. It has been addressed in version 8.0.2. "An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands," the company said.

Information security

Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months

China-linked Jewelbug conducted a five-month intrusion into a Russian IT service provider, accessing code repositories and exfiltrating data to Yandex Cloud.

Socket will block it with free malicious package firewall

Socket released Socket Firewall Free, a free CLI that blocks malicious dependencies at install time across npm, yarn, pnpm, pip, uv, and cargo.

8 months ago

Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories

Cursor's default-disabled Workspace Trust allows VS Code-style autorun tasks to execute on folder open, enabling arbitrary code execution and potential credential theft.

8 months ago

Stolen OAuth tokens expose Palo Alto customer data

Marc Benoit, chief information security officer at PAN, confirmed in a note to clients - seen by The Register - that it was informed on August 25 that the "compromise of a third-party application, Salesloft's Drift, resulted in the access and exfiltration of data stored in our Salesforce environment." It immediately disconnected the third-party application from its Salesforce CRM, he said.

Information security